HMAC & Hash Generator

Create HMAC signatures and hashes in hex or Base64, and check a webhook signature from Shopify, Razorpay, GitHub and others against the one you received.

Text

Encoded

Make a header

Username or API key Password or secret

Header

Value

Base64 only

Read a header

Authorization header or its Base64

Username

Password

Token

Empty

Check the signature

Not checked

Secret The secret is Base64-encoded

Header

Payload

Times and claims

Message

Signature

SHA-256 hash

Algorithm Key is

Secret key — leave empty for a plain hash

Hex

Base64

Compare with a signature you received

Questions

How do I verify a webhook signature?

Paste the raw request body as the message and the app's signing secret as the key, choose the algorithm, then paste the signature header into Compare. Shopify sends Base64 HMAC-SHA256, Razorpay sends hex HMAC-SHA256, and GitHub sends sha256= followed by hex.

Why doesn't my signature match?

The message has to be the exact body the app sent, byte for byte. Re-formatting the JSON, changing key order or trimming a line break changes the signature — so does using the API key where the webhook secret belongs.

What happens if I leave the key empty?

You get a plain hash of the message instead of an HMAC — for example the MD5 of a lowercase email address, which Mailchimp uses as a subscriber ID.

Is anything I paste sent to a server?

No. Every conversion runs in your browser, so tokens, passwords and secrets never leave your computer, and none of them are saved.

HMAC & Hash Generator

Text

Base64

Text

Encoded

URL parts

Make a header

Read a header

Token

Check the signature

Header

Payload

Times and claims

Message

Signature

How to use the HMAC & Hash Generator

Questions